Normalizing insufficient signals based on additional information

ABSTRACT

The present invention extends to methods, systems, and computer program products for normalizing insufficient signals based on additional information. A probability of an event occurring is detected from a raw signal. It is determined signal characteristics of the raw signal are insufficient to normalize the raw signal along at least one of: a time, location, or context dimension. In one aspect, an additional signal relevant to the signal is ingested. In another aspect, a previously detected event relevant to the signal is accessed from a geo cell database. The raw signal is normalized, including deriving at least one of: the time dimension, the location dimension, or the context dimension from a combination of the signal characteristics and characteristics of the other signal and/or characteristics of the previously detected event.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.16/394,620, entitled “Normalizing Insufficient Signals Based OnAdditional Information,” filed on Apr. 25, 2019, which is incorporatedherein in its entirety. That application is a continuation of U.S.patent application Ser. No. 16/280,391, now U.S. Pat. No. 10,324,950,entitled “Normalizing Insufficient Signals Based On AdditionalInformation,” filed on Feb. 20, 2019, which is incorporated herein inits entirety. That application is a continuation of U.S. patentapplication Ser. No. 16/170,325, now U.S. Pat. No. 10,268,642, entitled“Normalizing Insufficient Signals Based On Additional Information,”filed Oct. 25, 2018, which is incorporated herein in its entirety.

U.S. patent application Ser. No. 16/394,620 application claims thebenefit of U.S. Provisional Patent Application Ser. No. 62/664,001,entitled “Normalizing Different Types Of Ingested Signals Into A CommonFormat,” filed Apr. 27, 2018; U.S. Provisional Patent Application Ser.No. 62/667,337, entitled “On Demand Signal Acquisition Trigger FromEvidence Of Live Events,” filed May 4, 2018; U.S. Provisional PatentApplication Ser. No. 62/667,343, entitled “Using Prior Events As SignalsDuring Signal Ingestion,” filed May 4, 2018; U.S. Provisional PatentApplication Ser. No. 62/667,616, entitled, “Normalizing Different TypesOf Ingested Signals Into A Common Format,” filed May 7, 2018; U.S.Provisional Patent Application Ser. No. 62/685,814, entitled “IngestingStreaming Signals,” filed Jun. 15, 2018; U.S. Provisional PatentApplication Ser. No. 62/686,791, entitled, “Normalizing Signals,” filedJun. 19, 2018; and U.S. Provisional Patent Application Ser. No.62/691,806, entitled “Ingesting Streaming Signals,” filed Jun. 29, 2018,each of which is incorporated herein in its entirety.

BACKGROUND 1. Background and Relevant Art

Entities (e.g., parents, guardians, teachers, social workers, firstresponders, hospitals, delivery services, media outlets, governmententities, etc.) may desire to be made aware of relevant events as closeas possible to the events' occurrence (i.e., as close as possible to“moment zero”). Different types of ingested signals (e.g., social mediasignals, web signals, and streaming signals) can be used to identifyevents. Different types of signals can include different data types anddifferent data formats. Handling different types and formats of dataintroduces inefficiencies into subsequent event detection processes,including when determining if different signals relate to the sameevent. Further, individual ingested signals may contain insufficientinformation to identify an event.

BRIEF SUMMARY

Examples extend to methods, systems, and computer program products fornormalizing insufficient signals based on additional information.

A signal is ingested. A probability value is computed from signalcharacteristics of the signal. The probability value at leastapproximates a probability of an event occurring. It is determined thatsignal characteristics of the signal are insufficient to normalize thesignal along at least one of: a time dimension, a location dimension, ora context dimension.

In one aspect, additional information is obtained from an additionalsignal. A signal request requesting additional signals is triggered inview of the probability and in response to determining that the signalcharacteristics are insufficient. An additional signal relevant to thesignal is ingested. The signal is normalized including deriving at leastone of: the time dimension, the location dimension, or the contextdimension from a combination of the signal characteristics andcharacteristics of the other signal.

In another aspect, additional information is obtained from a previouslydetected event. Previously detected events within a specified distanceof the location are requested from a geo cell database in view of theprobability and in response to determining that the signalcharacteristics are insufficient. A previously detected event related tothe signal is received from the geo cell database. The signal isnormalized including deriving at least one of: the time dimension, thelocation dimension, or the context dimension from a combination of thesignal characteristics and characteristics of the previously detectedevent.

This summary is provided to introduce a selection of concepts in asimplified form that are further described below in the DetailedDescription. This Summary is not intended to identify key features oressential features of the claimed subject matter, nor is it intended tobe used as an aid in determining the scope of the claimed subjectmatter.

Additional features and advantages will be set forth in the descriptionwhich follows, and in part will be obvious from the description, or maybe learned by practice. The features and advantages may be realized andobtained by means of the instruments and combinations particularlypointed out in the appended claims. These and other features andadvantages will become more fully apparent from the followingdescription and appended claims, or may be learned by practice as setforth hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to describe the manner in which the above-recited and otheradvantages and features can be obtained, a more particular descriptionwill be rendered by reference to specific implementations thereof whichare illustrated in the appended drawings. Understanding that thesedrawings depict only some implementations and are not therefore to beconsidered to be limiting of its scope, implementations will bedescribed and explained with additional specificity and detail throughthe use of the accompanying drawings in which:

FIG. 1A illustrates an example computer architecture that facilitatesnormalizing ingesting signals.

FIG. 1B illustrates an example computer architecture that facilitatesdetecting events from normalized signals.

FIG. 2 illustrates an example computer architecture that facilitatesnormalizing an insufficient raw signal based on characteristics of arelated raw signal.

FIG. 3 illustrates a flow chart of an example method for normalizing aninsufficient raw signal based on characteristics of a related rawsignal.

FIG. 4 illustrates an example computer architecture that facilitatesnormalizing an insufficient raw signal based on characteristics of aprior detected event.

FIG. 5 illustrates a flow chart of an example method for normalizing aninsufficient raw signal based on characteristics of a prior detectedevent.

FIG. 6 illustrates an example of a more detailed computer architecturethat facilitates normalizing an insufficient raw signal based onadditional information.

DETAILED DESCRIPTION

Examples extend to methods, systems, and computer program products fornormalizing insufficient signals based on additional information.

Entities (e.g., parents, guardians, teachers, social workers, firstresponders, hospitals, delivery services, media outlets, governmententities, etc.) desire to be made aware of relevant events as close aspossible to the events' occurrence (i.e., as close as possible to“moment zero”). Event relevancy can differ between entities and may bebased on entity specific desires. For example, parents may be interestedin any police presence at or near their children's school. However, theparents are not necessarily interested in police presence in otherplaces. As another example, an ambulance service may be interested inmotor vehicle accidents with injuries that occur within their area ofoperation. However, the ambulance service is not necessarily interestedin accidents without injuries or accidents that occur outside their areaof operation.

In general, signal ingestion modules ingest different types of rawstructured and/or raw unstructured signals on an ongoing basis.Different types of raw signals can include different data media typesand different data formats, including Web signals. Data media types caninclude audio, video, image, and text. Different formats can includetext in XML, text in JavaScript Object Notation (JSON), text in RSSfeed, plain text, video stream in Dynamic Adaptive Streaming over HTTP(DASH), video stream in HTTP Live Streaming (HLS), video stream inReal-Time Messaging Protocol (RTMP), other Multipurpose Internet MailExtensions (MIME) types, etc. Handling different types and formats ofdata introduces inefficiencies into subsequent event detectionprocesses, including when determining if different signals relate to thesame event.

Accordingly, the signal ingestion modules can normalize raw signalsacross multiple data dimensions to form normalized signals. Eachdimension can be a scalar value or a vector of values. In one aspect,raw signals are normalized into normalized signals having a Time,Location, Context (or “TLC”) dimensions.

A Time (T) dimension can include a time of origin or alternatively a“event time” of a signal. A Location (L) dimension can include alocation anywhere across a geographic area, such as, a country (e.g.,the United States), a State, a defined area, an impacted area, an areadefined by a geo cell, an address, etc.

A Context (C) dimension indicates circumstances surroundingformation/origination of a raw signal in terms that facilitateunderstanding and assessment of the raw signal. The Context (C)dimension of a raw signal can be derived from express as well asinferred signal features of the raw signal.

Signal ingestion modules can include one or more single sourceclassifiers. A single source classifier can compute a single sourceprobability for a raw signal from features of the raw signal. A singlesource probability can reflect a mathematical probability orapproximation of a mathematical probability (e.g., a percentage between0%-100%) of an event actually occurring. A single source classifier canbe configured to compute a single source probability for a single eventtype or to compute a single source probability for each of a pluralityof different event types. A single source classifier can compute asingle source probability using artificial intelligence, machinelearning, neural networks, logic, heuristics, etc.

As such, single source probabilities and corresponding probabilitydetails can represent a Context (C) dimension. Probability details canindicate (e.g., can include a hash field indicating) a probabilisticmodel and (express and/or inferred) signal features considered in asignal source probability calculation.

Thus, per signal type, signal ingestion modules determine Time (T), aLocation (L), and a Context (C) dimensions associated with a raw signal.Different ingestion modules can be utilized/tailored to determine T, L,and C dimensions associated with different signal types. Normalized (or“TLC”) signals can be forwarded to an event detection infrastructure.When signals are normalized across common dimensions subsequent eventdetection is more efficient and more effective.

Normalization of ingested raw signals can include dimensionalityreduction. Generally, “transdimensionality” transformations can bestructured and defined in a “TLC” dimensional model. Signal ingestionmodules can apply the “transdimensionality” transformations to genericsource data in raw signals to re-encode the source data into normalizeddata having lower dimensionality. Thus, each normalized signal caninclude a T vector, an L vector, and a C vector. At lowerdimensionality, the complexity of measuring “distances” betweendimensional vectors across different normalized signals is reduced.

Concurrently with signal ingestion, an event detection infrastructureconsiders features of different combinations of normalized signals toattempt to identify events of interest to various parties. For example,the event detection infrastructure can determine that features ofmultiple different normalized signals collectively indicate an event ofinterest to one or more parties. Alternately, the event detectioninfrastructure can determine that features of one or more normalizedsignals indicate a possible event of interest to one or more parties.The event detection infrastructure then determines that features of oneor more other normalized signals validate the possible event as anactual event of interest to the one or more parties. Features ofnormalized signals can include: signal type, signal source, signalcontent, Time (T) dimension, Location (L) dimension, Context (C)dimension, other circumstances of signal creation, etc.

If the characteristics a raw signal provide insufficient information toderive one or more of: Time (T), Location (L), or Context (C)dimensions, signal enrichment services can refer to/access supplementalenriching data. Signal ingestion modules can then use the supplementalenriching data to derive any of: Time (T), Location (L), and Context (C)dimensions. In one aspect, signal enrichment services request additionalraw signals from one or more signal sources. The signal ingestionmodules use characteristics of one or more additional raw signals toinfer/derive one or more of: a Time (T) dimension, a Location (L)dimension, or Context (C) dimension for the raw signal.

The signal ingestion modules can use defined signal acquisition schemesfor a plurality of signal sources (data providers), such as, socialnetworks, social broadcasts, traffic reports, traffic cameras, liveweather, etc. A signal acquisition scheme for a signal source canspecify a signal acquisition volume corresponding to specifiedgeographic locations at specified time intervals. A signal acquisitionscheme can maximize signal acquisition up to some threshold below thatpermitted by a signal acquisition policy of a signal source. Thus,accessing signals from a signal source in accordance with a signalacquisition scheme does not fully consume that entity's allocated signalacquisition with the signal source. Some amount of allocated signalacquisition is held back to handle on-demand signal access requests(that can potentially occur at any time).

As such, the signal ingestion modules can acquire signals from aplurality of signal sources in accordance with a plurality ofcorresponding signal acquisition schemes. The signal ingestion modulesanalyze raw signals from the plurality of signal sources to attempt toidentify Time (T), Location (L), and Context (C) dimensions of occurringlive events (e.g., fire, police response, mass shooting, trafficaccident, natural disaster, storm, active shooter, concerts, protests,etc.).

Signal acquisition schemes can bias towards acquiring raw signalscorresponding to locations where events are more likely to occur, forexample, in heavier populated areas. On the other hand, signalacquisition schemes may be configured to less frequently acquire signalsor forgo signal acquisition, at least from some signal sources, forlocations where events are less likely to occur.

In one aspect, signal enrichment services trigger an on-demand signalacquisition request for an additional raw signal (the supplementalenriching data) from another signal source. The on-demand request is anexception to the signal acquisition scheme defined for the other signalsource. However, the on-demand signal acquisition request is unlikely toviolate a signal acquisition policy of the other signal source, since(in accordance with a defined scheme) some amount of allocated signalacquisition is held back to accommodate on-demand signal acquisitionrequests.

In another aspect, when a signal includes insufficient information toderive one or more of: Time (T), Location (L), or Context (C)dimensions, signal enrichment services can refer to/access supplementalenriching data from previously detected events. Signal ingestion modulescan then use the supplemental enriching data to derive any of: Time (T),Location (L), and Context (C) dimensions.

Implementations can comprise or utilize a special purpose orgeneral-purpose computer including computer hardware, such as, forexample, one or more computer and/or hardware processors (including anyof Central Processing Units (CPUs), and/or Graphical Processing Units(GPUs), general-purpose GPUs (GPGPUs), Field Programmable Gate Arrays(FPGAs), application specific integrated circuits (ASICs), TensorProcessing Units (TPUs)) and system memory, as discussed in greaterdetail below. Implementations also include physical and othercomputer-readable media for carrying or storing computer-executableinstructions and/or data structures. Such computer-readable media can beany available media that can be accessed by a general purpose or specialpurpose computer system. Computer-readable media that storecomputer-executable instructions are computer storage media (devices).Computer-readable media that carry computer-executable instructions aretransmission media. Thus, by way of example, and not limitation,implementations can comprise at least two distinctly different kinds ofcomputer-readable media: computer storage media (devices) andtransmission media.

Computer storage media (devices) includes RAM, ROM, EEPROM, CD-ROM,Solid State Drives (“SSDs”) (e.g., RAM-based or Flash-based), ShingledMagnetic Recording (“SMR”) devices, Flash memory, phase-change memory(“PCM”), other types of memory, other optical disk storage, magneticdisk storage or other magnetic storage devices, or any other mediumwhich can be used to store desired program code means in the form ofcomputer-executable instructions or data structures and which can beaccessed by a general purpose or special purpose computer.

In one aspect, one or more processors are configured to executeinstructions (e.g., computer-readable instructions, computer-executableinstructions, etc.) to perform any of a plurality of describedoperations. The one or more processors can access information fromsystem memory and/or store information in system memory. The one or moreprocessors can (e.g., automatically) transform information betweendifferent formats, such as, for example, between any of: raw signals,normalized signals, time dimensions, location dimensions, contextdimensions, search terms, geo cell entries, geo cell subsets, events,signal access policies, signal access schemes, event evidence, signalacquisition requests, queries, additional raw signals, previouslydetected events, etc.

System memory can be coupled to the one or more processors and can storeinstructions (e.g., computer-readable instructions, computer-executableinstructions, etc.) executed by the one or more processors. The systemmemory can also be configured to store any of a plurality of other typesof data generated and/or transformed by the described components, suchas, for example, raw signals, normalized signals, time dimensions,location dimensions, context dimensions, search terms, geo cell entries,geo cell subsets, events, signal access policies, signal access schemes,event evidence, signal acquisition requests, queries, additional rawsignals, previously detected events, etc.

A “network” is defined as one or more data links that enable thetransport of electronic data between computer systems and/or modulesand/or other electronic devices. When information is transferred orprovided over a network or another communications connection (eitherhardwired, wireless, or a combination of hardwired or wireless) to acomputer, the computer properly views the connection as a transmissionmedium. Transmissions media can include a network and/or data linkswhich can be used to carry desired program code means in the form ofcomputer-executable instructions or data structures and which can beaccessed by a general purpose or special purpose computer. Combinationsof the above should also be included within the scope ofcomputer-readable media.

Further, upon reaching various computer system components, program codemeans in the form of computer-executable instructions or data structurescan be transferred automatically from transmission media to computerstorage media (devices) (or vice versa). For example,computer-executable instructions or data structures received over anetwork or data link can be buffered in RAM within a network interfacemodule (e.g., a “NIC”), and then eventually transferred to computersystem RAM and/or to less volatile computer storage media (devices) at acomputer system. Thus, it should be understood that computer storagemedia (devices) can be included in computer system components that also(or even primarily) utilize transmission media.

Computer-executable instructions comprise, for example, instructions anddata which, in response to execution at a processor, cause a generalpurpose computer, special purpose computer, or special purposeprocessing device to perform a certain function or group of functions.The computer executable instructions may be, for example, binaries,intermediate format instructions such as assembly language, or evensource code. Although the subject matter has been described in languagespecific to structural features and/or methodological acts, it is to beunderstood that the subject matter defined in the appended claims is notnecessarily limited to the described features or acts described above.Rather, the described features and acts are disclosed as example formsof implementing the claims.

Those skilled in the art will appreciate that the described aspects maybe practiced in network computing environments with many types ofcomputer system configurations, including, personal computers, desktopcomputers, laptop computers, message processors, hand-held devices,wearable devices, multicore processor systems, multi-processor systems,microprocessor-based or programmable consumer electronics, network PCs,minicomputers, mainframe computers, mobile telephones, PDAs, tablets,routers, switches, and the like. The described aspects may also bepracticed in distributed system environments where local and remotecomputer systems, which are linked (either by hardwired data links,wireless data links, or by a combination of hardwired and wireless datalinks) through a network, both perform tasks. In a distributed systemenvironment, program modules may be located in both local and remotememory storage devices.

Further, where appropriate, functions described herein can be performedin one or more of: hardware, software, firmware, digital components, oranalog components. For example, one or more Field Programmable GateArrays (FPGAs) and/or one or more application specific integratedcircuits (ASICs) and/or one or more Tensor Processing Units (TPUs) canbe programmed to carry out one or more of the systems and proceduresdescribed herein. Hardware, software, firmware, digital components, oranalog components can be specifically tailor-designed for a higher speeddetection or artificial intelligence that can enable signal processing.In another example, computer code is configured for execution in one ormore processors, and may include hardware logic/electrical circuitrycontrolled by the computer code. These example devices are providedherein purposes of illustration, and are not intended to be limiting.Embodiments of the present disclosure may be implemented in furthertypes of devices.

The described aspects can also be implemented in cloud computingenvironments. In this description and the following claims, “cloudcomputing” is defined as a model for enabling on-demand network accessto a shared pool of configurable computing resources. For example, cloudcomputing can be employed in the marketplace to offer ubiquitous andconvenient on-demand access to the shared pool of configurable computingresources (e.g., compute resources, networking resources, and storageresources). The shared pool of configurable computing resources can beprovisioned via virtualization and released with low effort or serviceprovider interaction, and then scaled accordingly.

A cloud computing model can be composed of various characteristics suchas, for example, on-demand self-service, broad network access, resourcepooling, rapid elasticity, measured service, and so forth. A cloudcomputing model can also expose various service models, such as, forexample, Software as a Service (“SaaS”), Platform as a Service (“PaaS”),and Infrastructure as a Service (“IaaS”). A cloud computing model canalso be deployed using different deployment models such as privatecloud, community cloud, public cloud, hybrid cloud, and so forth. Inthis description and in the following claims, a “cloud computingenvironment” is an environment in which cloud computing is employed.

In this description and the following claims, a “geo cell” is defined asa piece of “cell” in a spatial grid in any form. In one aspect, geocells are arranged in a hierarchical structure. Cells of differentgeometries can be used.

A “geohash” is an example of a “geo cell”.

In this description and the following claims, “geohash” is defined as ageocoding system which encodes a geographic location into a short stringof letters and digits. Geohash is a hierarchical spatial data structurewhich subdivides space into buckets of grid shape (e.g., a square).Geohashes offer properties like arbitrary precision and the possibilityof gradually removing characters from the end of the code to reduce itssize (and gradually lose precision). As a consequence of the gradualprecision degradation, nearby places will often (but not always) presentsimilar prefixes. The longer a shared prefix is, the closer the twoplaces are. geo cells can be used as a unique identifier and toapproximate point data (e.g., in databases).

In one aspect, a “geohash” is used to refer to a string encoding of anarea or point on the Earth. The area or point on the Earth may berepresented (among other possible coordinate systems) as alatitude/longitude or Easting/Northing—the choice of which is dependenton the coordinate system chosen to represent an area or point on theEarth. geo cell can refer to an encoding of this area or point, wherethe geo cell may be a binary string comprised of 0s and 1s correspondingto the area or point, or a string comprised of 0s, 1s, and a ternarycharacter (such as X)—which is used to refer to a don't care character(0 or 1). A geo cell can also be represented as a string encoding of thearea or point, for example, one possible encoding is base-32, whereevery 5 binary characters are encoded as an ASCII character.

Depending on latitude, the size of an area defined at a specified geocell precision can vary. When geohash is used for spatial indexing, theareas defined at various geo cell precisions are approximately:

TABLE 1 Example Areas at Various Geohash Precisions GeohashLength/Precision width × height 1 5,009.4 km × 4,992.6 km 2 1,252.3 km ×624.1 km  3 156.5 km × 156 km  4 39.1 km × 19.5 km 5 4.9 km × 4.9 km 6 1.2 km × 609.4 m 7 152.9 m × 152.4 m 8 38.2 m × 19 m  9 4.8 m × 4.8 m10  1.2 m × 59.5 cm 11 14.9 cm × 14.9 cm 12 3.7 cm × 1.9 cmOther geo cell geometries, such as, hexagonal tiling, triangular tiling,etc. are also possible. For example, the H3 geospatial indexing systemis a multi-precision hexagonal tiling of a sphere (such as the Earth)indexed with hierarchical linear indexes.

In another aspect, geo cells are a hierarchical decomposition of asphere (such as the Earth) into representations of regions or pointsbased a Hilbert curve (e.g., the S2 hierarchy or other hierarchies).Regions/points of the sphere can be projected into a cube and each faceof the cube includes a quad-tree where the sphere point is projectedinto. After that, transformations can be applied and the spacediscretized. The geo cells are then enumerated on a Hilbert Curve (aspace-filling curve that converts multiple dimensions into one dimensionand preserves the approximate locality).

Due to the hierarchical nature of geo cells, any signal, event, entity,etc., associated with a geo cell of a specified precision is by defaultassociated with any less precise geo cells that contain the geo cell.For example, if a signal is associated with a geo cell of precision 9,the signal is by default also associated with corresponding geo cells ofprecisions 1, 2, 3, 4, 5, 6, 7, and 8. Similar mechanisms are applicableto other tiling and geo cell arrangements. For example, S2 has a celllevel hierarchy ranging from level zero (85,011,012 km²) to level 30(between 0.48 cm² to 0.96 cm²).

Signal Ingestion and Normalization

Signal ingestion modules ingest a variety of raw structured and/or rawunstructured signals on an on going basis and in essentially real-time.Raw signals can include social posts, live broadcasts, traffic camerafeeds, other camera feeds (e.g., from other public cameras or from CCTVcameras), listening device feeds, 911 calls, weather data, plannedevents, IoT device data, crowd sourced traffic and road information,satellite data, air quality sensor data, smart city sensor data, publicradio communication (e.g., among first responders and/or dispatchers,between air traffic controllers and pilots), etc. The content of rawsignals can include images, video, audio, text, etc.

In general, signal normalization can prepare (or pre-process) rawsignals into normalized signals to increase efficiency and effectivenessof subsequent computing activities, such as, event detection, eventnotification, etc., that utilize the normalized signals. For example,signal ingestion modules can normalize raw signals, including rawstreaming signals, into normalized signals having a Time, Location, andContext (TLC) dimensions. An event detection infrastructure can use theTime, Location, and Content dimensions to more efficiently andeffectively detect events.

Per signal type and signal content, different normalization modules canbe used to extract, derive, infer, etc. Time, Location, and Contextdimensions from/for a raw signal. For example, one set of normalizationmodules can be configured to extract/derive/infer Time, Location andContext dimensions from/for social signals. Another set of normalizationmodules can be configured to extract/derive/infer Time, Location andContext dimensions from/for Web signals. A further set of normalizationmodules can be configured to extract/derive/infer Time, Location andContext dimensions from/for streaming signals.

Normalization modules for extracting/deriving/inferring Time, Location,and Context dimensions can include text processing modules, NLP modules,image processing modules, video processing modules, etc. The modules canbe used to extract/derive/infer data representative of Time, Location,and Context dimensions for a raw signal. Time, Location, and Contextdimensions for a raw signal can be extracted/derived/inferred frommetadata, characteristics of the raw signal, characteristics of otherraw signals, characteristics of previously detected events, etc.

For example, NLP modules can analyze metadata and content of a soundclip to identify a time, location, and keywords (e.g., fire, shooter,etc.). An acoustic listener can also interpret the meaning of sounds ina sound clip (e.g., a gunshot, vehicle collision, etc.) and convert torelevant context. Live acoustic listeners can determine the distance anddirection of a sound. Similarly, image processing modules can analyzemetadata and pixels in an image to identify a time, location andkeywords (e.g., fire, shooter, etc.). Image processing modules can alsointerpret the meaning of parts of an image (e.g., a person holding agun, flames, a store logo, etc.) and convert to relevant context. Othermodules can perform similar operations for other types of contentincluding text and video.

Per signal type, each set of normalization modules can differ but mayinclude at least some similar modules or may share some common modules.For example, similar (or the same) image analysis modules can be used toextract named entities from social signal images and public camerafeeds. Likewise, similar (or the same) NLP modules can be used toextract named entities from social signal text and web text.

In some aspects, an ingested raw signal includes sufficient expresslydefined time, location, and context information upon ingestion. Theexpressly defined time, location, and context information is used todetermine Time, Location, and Context dimensions for the ingested rawsignal. In other aspects, an ingested signal lacks expressly definedlocation information or expressly defined location information isinsufficient (e.g., lacks precision) upon ingestion. In these otheraspects, Location dimension or additional Location dimension can beinferred from features of an ingested signal and/or through referencesto other data sources. In further aspects, an ingested signal lacksexpressly defined context information or expressly defined contextinformation is insufficient (e.g., lacks precision) upon ingestion. Inthese further aspects, Context dimension or additional Context dimensioncan be inferred from features of an ingested signal and/or throughreference to other data sources. Other data sources can includeadditional raw signals and previously detected events.

In additional aspects, time information may not be included, or includedtime information may not be given with high enough precision and Timedimension is inferred. For example, a user may post an image to a socialnetwork which had been taken some indeterminate time earlier.

Normalization modules can use named entity recognition and reference toa geo cell database to infer Location dimension. Named entities can berecognized in text, images, video, audio, or sensor data. The recognizednamed entities can be compared to named entities in geo cell entries.Matches indicate possible signal origination in a geographic areadefined by a geo cell.

As such, a normalized signal can include a Time dimension, a Locationdimension, a Context dimension (e.g., single source probabilities andprobability details), a signal type, a signal source, and content.

A single source probability can be calculated by single sourceclassifiers (e.g., machine learning models, artificial intelligence,neural networks, statistical models, etc.) that consider hundreds,thousands, or even more signal features of a signal. Single sourceclassifiers can be based on binary models and/or multi-class models.

FIG. 1A depicts part of computer architecture 100 that facilitatesingesting and normalizing signals. As depicted, computer architecture100 includes signal ingestion modules 101, social signals 171, websignals 172, and streaming signals 173. Signal ingestion modules 101,social signals 171, web signals 172, and streaming signals 173 can beconnected to (or be part of) a network, such as, for example, a systembus, a Local Area Network (“LAN”), a Wide Area Network (“WAN”), and eventhe Internet. Accordingly, signal ingestion modules 101, social signals171, web signals 172, and streaming signals 173 as well as any otherconnected computer systems and their components can create and exchangemessage related data (e.g., Internet Protocol (“IP”) datagrams and otherhigher layer protocols that utilize IP datagrams, such as, TransmissionControl Protocol (“TCP”), Hypertext Transfer Protocol (“HTTP”), SimpleMail Transfer Protocol (“SMTP”), Simple Object Access Protocol (SOAP),etc. or using other non-datagram protocols) over the network.

Signal ingestion module(s) 101 can ingest raw signals 121, includingsocial signals 171, web signals 172, and streaming signals 173 (e.g.,social posts, traffic camera feeds, other camera feeds, listening devicefeeds, 911 calls, weather data, planned events, IoT device data, crowdsourced traffic and road information, satellite data, air quality sensordata, smart city sensor data, public radio communication, etc.) ongoingbasis and in essentially real-time. Signal ingestion module(s) 101include social content ingestion modules 174, web content ingestionmodules 175, stream content ingestion modules 176, and signal formatter180. Signal formatter 180 further includes social signal processingmodule 181, web signal processing module 182, and stream signalprocessing modules 183.

In general, a raw signal can include various characteristics includingone or more of: a time stamp, location information (e.g., lat/lon, GPScoordinates, etc.), context information (e.g., text expressly indicatinga type of event), a signal type (e.g., social media, 911 communication,traffic camera feed, etc.), a signal source (e.g., Facebook, twitter,Waze, etc.), and content (e.g., one or more of: image, video, text,keyword, locale, etc.). Streaming signals 173 can include live videoand/or non-live (previously stored) video.

For each type of raw signal, a corresponding ingestion module and signalprocessing module can interoperate to normalize the signal along Time,Location, Context (TLC) dimensions. For example, social contentingestion modules 174 and social signal processing module 181 caninteroperate to normalize social signals 171 into TLC dimensions.Similarly, web content ingestion modules 175 and web signal processingmodule 182 can interoperate to normalize web signals 172 into TLCdimensions. Likewise, stream content ingestion modules 176 and streamsignal processing modules 183 can interoperate to normalize streamingsignals 173 into TLC dimensions.

In one aspect, signal content exceeding specified size requirements(e.g., audio or video) is cached upon ingestion. Signal ingestionmodules 101 include a URL or other identifier to the cached contentwithin the context for the signal.

In one aspect, signal formatter 180 includes modules for determining asingle source probability as a ratio of signals turning into eventsbased on the following signal properties: (1) event class (e.g., fire,accident, weather, etc.), (2) media type (e.g., text, image, audio,etc.), (3) source (e.g., twitter, traffic camera, first responder radiotraffic, etc.), and (4) geo type (e.g., geo cell, region, or non-geo).Probabilities can be stored in a lookup table for different combinationsof the signal properties. Features of a signal can be derived and usedto query the lookup table. For example, the lookup table can be queriedwith terms (“accident”, “image”, “twitter”, “region”). The correspondingratio (probability) can be returned from the table.

In another aspect, signal formatter 180 includes a plurality of singlesource classifiers (e.g., artificial intelligence, machine learningmodules, neural networks, etc.). Each single source classifier canconsider hundreds, thousands, or even more signal features of a signal.Signal features of a signal can be derived and submitted to a signalsource classifier. The single source classifier can return a probabilitythat a signal indicates a type of event. Single source classifiers canbe binary classifiers or multi-source classifiers.

Raw classifier output can be adjusted to more accurately represent aprobability that a signal is a “true positive”. For example, 1,000signals whose raw classifier output is 0.9 may include 80% as truepositives. Thus, probability can be adjusted to 0.8 to reflect trueprobability of the signal being a true positive. “Calibration” can bedone in such a way that for any “calibrated score” this score reflectsthe true probability of a true positive outcome.

Signal ingestion modules 101 can insert one or more single sourceprobabilities and corresponding probability details into a normalizedsignal to represent a Context (C) dimension. Probability details canindicate a probabilistic model and features used to calculate theprobability. In one aspect, a probabilistic model and signal featuresare contained in a hash field.

Signal ingestion modules 101 can utilize “transdimensionality”transformations structured and defined in a “TLC” dimensional model.Signal ingestion modules 101 can apply the “transdimensionality”transformations to generic source data in raw signals to re-encode thesource data into normalized data having lower dimensionality.Dimensionality reduction can include reducing dimensionality of a rawsignal to a normalized signal including a T vector, an L vector, and a Cvector. At lower dimensionality, the complexity and resource consumptionof measuring “distances” between dimensional vectors across differentnormalized signals is reduced.

Thus, in general, any received raw signals can be normalized intonormalized signals including a Time (T) dimension, a Location (L)dimension, a Context (C) dimension, signal source, signal type, andcontent. Signal ingestion modules 101 can send normalized signals 122 toevent detection infrastructure 103.

For example, signal ingestion modules 101 can send normalized signal122A, including time (dimension) 123A, location (dimension) 124A,context (dimension) 126A, content 127A, type 128A, and source 129A toevent detection infrastructure 103. Similarly, signal ingestion modules101 can send normalized signal 122B, including time (dimension) 123B,location (dimension) 124B, context (dimension) 126B, content 127B, type128B, and source 129B to event detection infrastructure 103.

Event Detection

FIG. 1B depicts part of computer architecture 100 that facilitatesdetecting events. As depicted, computer architecture 100 includes eventdetection infrastructure 103, geo cell database 111 and eventnotification 116. Geo cell database 111 and event notification 116 canbe connected to (or be part of) a network with signal ingestion modules101 and event detection infrastructure 103. As such, geo cell database111 and event notification 116 can create and exchange message relateddata over the network.

As described, in general, on an ongoing basis and concurrently withsignal ingestion (and also essentially in real-time), event detectioninfrastructure 103 detects different categories of (planned andunplanned) events (e.g., fire, police response, mass shooting, trafficaccident, natural disaster, storm, active shooter, concerts, protests,etc.) in different locations (e.g., anywhere across a geographic area,such as, the United States, a State, a defined area, an impacted area,an area defined by a geo cell, an address, etc.), at different timesfrom Time, Location, and Context dimensions included in normalizedsignals. Event detection infrastructure can likewise detect changes toexisting (planned and unplanned) events. Since, normalized signals arenormalized to include Time, Location, and Context dimensions (vectors),event detection infrastructure 103 can handle normalized signals in amore uniform manner. Handling signals in a more uniform manner increasesevent detection and event change detection efficiency and effectivenessand also reduces resource consumption. For example, Time, Location, andContext vectors of different normalized signals can be compared (insteadof comparing along numerous, and possibly differing and/or non-uniform,other dimensions).

Event detection infrastructure 103 can also determine an eventtruthfulness (e.g., erroneous detection results, detections based ontampered source data, detections of fictional or staged events), eventseverity, and an associated geo cell. In one aspect, context informationin a normalized signal increases the efficiency and effectiveness ofdetermining truthfulness, severity, and an associated geo cell.

Generally, an event truthfulness indicates how likely a detected eventis actually an event (vs. a hoax, fake, misinterpreted, etc.).Truthfulness can range from less likely to be true to more likely to betrue. In one aspect, truthfulness is represented as a numerical value,such as, for example, from 1 (less truthful) to 10 (more truthful) or aspercentage value in a percentage range, such as, for example, from 0%(less truthful) to 100% (more truthful). Other truthfulnessrepresentations are also possible. For example, truthfulness can be adimension and/or can be represented by one or more vectors.

Generally, an event severity indicates how severe an event is (e.g.,what degree of badness, what degree of damage, etc. is associated withthe event). Severity can range from less severe (e.g., a single vehicleaccident without injuries) to more severe (e.g., multi vehicle accidentwith multiple injuries and a possible fatality). As another example, ashooting event can also range from less severe (e.g., one victim withoutlife threatening injuries) to more severe (e.g., multiple injuries andmultiple fatalities). In one aspect, severity is represented as anumerical value, such as, for example, from 1 (less severe) to 5 (moresevere). Other severity representations are also possible. For example,severity can be a dimension and/or can be represented by one or morevectors.

In general, event detection infrastructure 103 can include a geodetermination module including modules for processing different kinds ofcontent including location, time, context, text, images, audio, andvideo into search terms. The geo determination module can query a geocell database with search terms formulated from normalized signalcontent. The geo cell database can return any geo cells having matchingsupplemental information. For example, if a search term includes astreet name, a subset of one or more geo cells including the street namein supplemental information can be returned to the event detectioninfrastructure.

Event detection infrastructure 103 can use the subset of geo cells todetermine a geo cell associated with an event location. Eventsassociated with a geo cell can be stored back into an entry for the geocell in the geo cell database. Thus, over time an historical progressionof events within a geo cell can be accumulated.

As such, event detection infrastructure 103 can assign an event ID, anevent time, an event location, an event category, an event description,an event truthfulness, and an event severity to each detected event.Detected events can be sent to relevant entities, including to mobiledevices, to computer systems, to APIs, to data storage, etc.

Event detection infrastructure 103 detects events from informationcontained in normalized signals 122. Event detection infrastructure 103can detect an event from a single normalized signal 122 or from multiplenormalized signals 122. In one aspect, event detection infrastructure103 detects an event based on information contained in one or morenormalized signals 122. In another aspect, event detectioninfrastructure 103 detects a possible event based on informationcontained in one or more normalized signals 122. Event detectioninfrastructure 103 then validates the potential event as an event basedon information contained in one or more other normalized signals 122.

As depicted, event detection infrastructure 103 includes geodetermination module 104, categorization module 106, truthfulnessdetermination module 107, and severity determination module 108.

Geo determination module 104 can include NLP modules, image analysismodules, etc. for identifying location information from a normalizedsignal. Geo determination module 104 can formulate (e.g., location)search terms 141 by using NLP modules to process audio, using imageanalysis modules to process images, etc. Search terms can include streetaddresses, building names, landmark names, location names, school names,image fingerprints, etc. Event detection infrastructure 103 can use aURL or identifier to access cached content when appropriate.

Categorization module 106 can categorize a detected event into one of aplurality of different categories (e.g., fire, police response, massshooting, traffic accident, natural disaster, storm, active shooter,concerts, protests, etc.) based on the content of normalized signalsused to detect and/or otherwise related to an event.

Truthfulness determination module 107 can determine the truthfulness ofa detected event based on one or more of: source, type, age, and contentof normalized signals used to detect and/or otherwise related to theevent. Some signal types may be inherently more reliable than othersignal types. For example, video from a live traffic camera feed may bemore reliable than text in a social media post. Some signal sources maybe inherently more reliable than others. For example, a social mediaaccount of a government agency may be more reliable than a social mediaaccount of an individual. The reliability of a signal can decay overtime.

Severity determination module 108 can determine the severity of adetected event based on or more of: location, content (e.g., dispatchcodes, keywords, etc.), and volume of normalized signals used to detectand/or otherwise related to an event. Events at some locations may beinherently more severe than events at other locations. For example, anevent at a hospital is potentially more severe than the same event at anabandoned warehouse. Event category can also be considered whendetermining severity. For example, an event categorized as a “Shooting”may be inherently more severe than an event categorized as “PolicePresence” since a shooting implies that someone has been injured.

Geo cell database 111 includes a plurality of geo cell entries. Each geocell entry is included in a geo cell defining an area and correspondingsupplemental information about things included in the defined area. Thecorresponding supplemental information can include latitude/longitude,street names in the area defined by and/or beyond the geo cell,businesses in the area defined by the geo cell, other Areas of Interest(AOIs) (e.g., event venues, such as, arenas, stadiums, theaters, concerthalls, etc.) in the area defined by the geo cell, image fingerprintsderived from images captured in the area defined by the geo cell, andprior events that have occurred in the area defined by the geo cell. Forexample, geo cell entry 151 includes geo cell 152, lat/lon 153, streets154, businesses 155, AOIs 156, and prior events 157. Each event in priorevents 157 can include a location (e.g., a street address), a time(event occurrence time), an event category, an event truthfulness, anevent severity, and an event description. Similarly, geo cell entry 161includes geo cell 162, lat/lon 163, streets 164, businesses 165, AOIs166, and prior events 167. Each event in prior events 167 can include alocation (e.g., a street address), a time (event occurrence time), anevent category, an event truthfulness, an event severity, and an eventdescription.

Other geo cell entries can include the same or different (more or less)supplemental information, for example, depending on infrastructuredensity in an area. For example, a geo cell entry for an urban area cancontain more diverse supplemental information than a geo cell entry foran agricultural area (e.g., in an empty field). Sufficiently precise geocells can be used to increase the practicality of storing matchingcontent.

Geo cell database 111 can store geo cell entries in a hierarchicalarrangement based on geo cell precision. As such, geo cell informationof more precise geo cells is included in the geo cell information forany less precise geo cells that include the more precise geo cell.

Geo determination module 104 can query geo cell database 111 with searchterms 141. Geo cell database 111 can identify any geo cells havingsupplemental information that matches search terms 141. For example, ifsearch terms 141 include a street address and a business name, geo celldatabase 111 can identify geo cells having the street name and businessname in the area defined by the geo cell. Geo cell database 111 canreturn any identified geo cells to geo determination module 104 in geocell subset 142.

Geo determination module can use geo cell subset 142 to determine thelocation of event 135 and/or a geo cell associated with event 135. Asdepicted, event 135 includes event ID 132, time 133, location 137,description 136, category 137, truthfulness 138, and severity 139.

Event detection infrastructure 103 can also determine that event 135occurred in an area defined by geo cell 162 (e.g., a geohash havingprecision of level 7 or level 9). For example, event detectioninfrastructure 103 can determine that location 134 is in the areadefined by geo cell 162. As such, event detection infrastructure 103 canstore event 135 in events 167 (i.e., historical events that haveoccurred in the area defined by geo cell 162). Other events can bestored in events 167 or other geo cell entries as the events aredetected. As such, geo cell database can store an event history percell. Other modules can refer to the event history when appropriate.

Event detection infrastructure 103 can also send event 135 to eventnotification module 116. Event notification module 116 can notify one ormore entities about event 135.

Normalizing an Insufficient Raw Signal Based on Characteristics of aRelated Raw Signal

FIG. 2 illustrates an example computer architecture 200 that facilitatesnormalizing an insufficient raw signal based on characteristics of arelated raw signal. As depicted in computer architecture 200, signalingestion modules 101 further include signal acquisition module 287 andsignal enrichment services 284. Signal acquisition module 287 can span,include, and/or be integrated with social content ingestion modules 174,web content ingestion modules 175, and stream content ingestion modules176 to acquire any of social signals, web signals, and streaming signals(as well as other raw signals 121). For example, signal acquisitionmodule 287 can acquire raw signals 121B, 121A and 121D, and 121C fromsources 171A, 171B, and 171C respectively. Source 171A can be a socialsignal source included in social signals 171. Source 172A can be a websignal source included in web signals 172. Source 173A can be astreaming signal source included in streaming signals 173.

Each of ingested raw signals 121A, 121B, 121C, 1212D, etc. can includeone or more of: a time stamp, location information (e.g., lat/lon, GPScoordinates, etc.), context information (e.g., text expressly indicatinga type of event), a signal type (e.g., social media, 911 communication,traffic camera feed, etc.), a signal source (e.g., Facebook, twitter,Waze, etc.), and content (e.g., one or more of: image, video, text,keyword, locale, etc.). Any streaming signals can include live videoand/or non-live (previously stored) video. Raw signals may include allor less than all of a time stamp, location information, contextinformation, signal type, signal source, and content. Informationincluded in a raw may also be more or less accurate and/or precise. Forexample, a location of “San Francisco” is less accurate than a level 9geo hash. Thus, even when a raw signal includes information, theinformation may be insufficient for normalization due to lack ofprecisions and/or accuracy.

Signal sources can regulate (e.g., place limits on) when and how rawsignals can be acquired, such as, for example, signal acquisition volumeper minute. Signal acquisition module 287 can implement correspondingsignal access schemes. Signal access schemes can be used to maximize rawsignal acquisition per source while holding back some signal acquisitionvolume. The held back signal acquisition volume can be used toaccommodate on-demand signal acquisition request without violatingcorresponding signal access policies.

For example, signal acquisition from source 171A can be regulated bypolicy 241. Policy 241 defines limits on when and how raw signals can beacquired from source 171A, such as, for example, a signal acquisitionvolume limit per minute. Scheme 243 can define how to maximize signalacquisition from source 171A without violating policy 241. For example,scheme 243 can define acquiring a specified signal volume on an ongoingbasis while holding back some signal volume to accommodate on-demandsignal acquisition requests. Accordingly, signal acquisition module 287can maximize raw signal acquisition from source 171A without violatingpolicy 241.

Similarly, signal acquisition from source 172A can be regulated bypolicy 242. Policy 242 defines limits on when and how raw signals can beacquired from source 172A, such as, for example, a signal acquisitionvolume limit per minute. Scheme 244 can define how to maximize signalacquisition from source 172A without violating policy 242. For example,scheme 244 can define acquiring a specified signal volume on an ongoingbasis while holding back some signal volume to accommodate on-demandsignal acquisition requests. Accordingly, signal acquisition module 287can maximize raw signal acquisition from source 173A without violatingpolicy 242.

As such, data ingestion module(s) 101 can ingest raw signals 121,including signals from source 171A, source 172A, and source 173A, on anongoing basis and in essentially real-time. More specifically, signalacquisition module 287 can acquire signal 121B (in accordance withscheme 243), signals 121A and 121D (in accordance with scheme 244), andsignal 121C from sources 171A, 172A, and 173A respectively.

Some ingested/acquired raw signals may provide evidence of a live eventand others may not. Some ingested/acquired raw signals may also includesufficient information to normalize into a TLC, format and others maynot. Formatter 180 can examine characteristic of ingested/acquired rawsignals for evidence of live events and to determine sufficiency fornormalization. Signal formatter 180 may discard raw signals that do notinclude evidence of a live event.

Signal formatter 180 can normalize raw signals that include evidence ofa live event. When characteristics of a raw signal are sufficient fornormalizing the raw signal, signal formatter 180 can normalize the rawsignal into a TLC format based on the characteristics of the raw signal.When characteristics of a raw signal are insufficient for normalization,signal formatter can send the evidence of the live event to signalenrichment services 284.

In response to receiving live event evidence, signal enrichment services284 can formulate a signal acquisition request including (at least aportion of) the live event evidence. Signal enrichment services 284 cansend the signal acquisition request to signal acquisition module 287 to(on-demand) request an additional signal related to the live eventevidence (and thus related to the examined raw signal). Based on asignal acquisition request, signal acquisition module 287 can query oneor more signal sources (e.g., from among sources 171A, 172A, and 172A)on-demand for any additional raw signals related to the examined rawsignal. Any of the one or more signal sources including a related rawsignal can return the related raw signal to signal acquisition module287. Signal acquisition module 287 can send the related raw signal tosignal enrichment services 284 and/or signal formatter 180. Since somesignal acquisition volume is held back for on-demand requests (inaccordance with schemes 243, 244, etc.), the on-demand request isunlikely to violate signal source acquisition policies.

In another aspect, signal acquisition module 287 may have acquired oneor more related raw signals prior to receiving a signal acquisitionrequest. For example, when a live event is occurring, multiple differentraw signals related to the live event may be generated from multipledifferent signal sources. Thus, if characteristics of one raw signal areinsufficient for normalization, one or more other raw signals mayinclude supplemental information to remediate the insufficiency. Signalacquisition module 287 can return the one or more other raw signals tosignal enrichment services 284 and/or signal formatter 180 in responseto a signal acquisition request.

In one aspect, signal acquisition module 287 may have access to somerelated raw signals and may query signal sources for additional relatedraw signals. Characteristics of/information from any of these rawsignals can be used to supplement an insufficient raw signal.

Signal enrichment services 284 can supplement characteristics of anexamined raw signal with information from a related raw signal. Signalformatter 180 can normalize the examined raw signal into a TLC formatusing a combination of characteristics of the examined raw signal andthe supplemental information. In one aspect, supplemental informationincludes characteristics of the related raw signal. The supplementalinformation can be used to derive any of: a time dimension, a locationdimension, or a context dimension of the examined raw signal.

FIG. 3 illustrates a flow chart of an example method for normalizing aninsufficient raw signal based on characteristics of a related rawsignal. Method 300 will be described with respect to the components anddata in computer architecture 200.

Method 300 includes ingesting a raw signal including a time stamp, anindication of a signal type, an indication of a signal source, andcontent from the signal source (301). For example, signal acquisitionmodule 287 can access raw signal 121B from source 171A. Raw signal 121Bcan include a time stamp, can indicate a signal type, can identifysource 171A, and can include content from source 171A. In one aspect,signal acquisition module 287 accesses raw signal 121B in accordancewith scheme 243 so as to not violate policy 241.

Signal acquisition module 287 can send raw signal 121B to signalformatter 180.

Method 300 includes detecting evidence of an event from the content(302). For example, signal formatter 180 can detect evidence 291 of anevent from the characteristics, and including the content, of raw signal121B. Method 300 includes determining that signal characteristics of theraw signal are insufficient to normalize the signal along at least oneof: a time dimension, a location dimension, or a context dimension intoa Time, Location, Context (TLC) format (303). For example, signalformatter 180 can determine that the signal characteristics of rawsignal 121B are insufficient to normalize raw signal 121B along at leastone of: a time dimension, a location dimension, or a context dimensioninto a TLC format. In response to detecting evidence 291 andinsufficiency of the signal characteristics of raw signal 121B, signalformatter 180 can send evidence 291 to signal enrichment services 284.Signal enrichment services 284 can receive evidence 291 from signalformatter 180.

Method 300 includes triggering a signal request requesting additionalsignals related to the detected evidence in response to determining thatthe signal characteristics are insufficient (304). For example, inresponse to receiving evidence 291, signal enrichment services 284 canformulate signal acquisition request 292, including (at least a portionof) evidence 291. Signal enrichment services 284 can send signalacquisition request 292 to signal acquisition module 287. Signalacquisition module 287 can receive signal acquisition request 292 fromsignal enrichment services 284.

Method 300 includes accessing an additional raw signal related to thedetected evidence from another signal source (305). For example, signalacquisition module 287 can compare evidence 291 (or the portion thereof)to other acquired raw signals to attempt to identify related rawsignals. Alternately or in combination, signal acquisition module 287can use evidence 291 (of the portion thereof) to formulate relatedsignal queries. Signal acquisition module 287 can send related signalqueries to signal sources (e.g., 171A, 172A, 173A, etc.) requestingsignals related to evidence 291 (or the portion thereof). Either throughprior acquisition or in response to a query, signal acquisition module287 can access raw signal 121D. The characteristics of raw signal 121Dcan indicate a relationship to evidence 291 (or the portion thereof).Signal acquisition module 287 can send raw signal 121D to signalenrichment services 284 and/or signal formatter 180. Signal enrichmentservices 284 and/or signal formatter 180 can supplement raw signal 121Bwith characteristics of raw signal 121D to remediate any normalizationinsufficiencies.

Method 300 includes normalizing the raw signal into the Time, Location,Context (TLC) format including deriving at least one of: the timedimension, the location dimension, or the context dimension from acombination of the signal characteristics and characteristics of theadditional raw signal (306). For example, signal enrichment services 284and/or signal formatter 180 can normalize raw signal 121B intonormalized signal 122C, including time 123C, location 124C, context126C, content 127C, type 128C, and source 129C. Normalization caninclude deriving at least one of time 123C, location 124C, and context126C from a combination of characteristics of raw signal 121B andcharacteristics of signal 121D.

Normalizing an Insufficient Raw Signal Based on Characteristics of aPrior Detected Event

FIG. 4 illustrates an example computer architecture 400 that facilitatesnormalizing an insufficient raw signal based on characteristics of aprior detected event. As depicted in computer architecture 400, signalenrichment services 284 can query geo cell database 111. Queries of geocell database 111 can include evidence of a live event (or portionsthereof) identified by signal formatter 180. In response to a query, geocell database 111 can return one or more prior detected events relatedto the evidence. Signal enrichment services 284 can remediate raw signalinsufficiencies with information from the one or more prior events tofacilitate normalizing a raw signal into a TLC format.

Data ingestion module(s) 101 can ingest raw signals 121, includingsignals from source 171B (included in social signals 171), source 172B(included in web signals 172), and source 173B (included in streamingsignals 173), on an ongoing basis and in essentially real-time. Morespecifically, signal acquisition module 287 can acquire signal 121E,signal 121F, and signal 121G from sources 171B, 172B, and 173Brespectively.

FIG. 5 illustrates a flow chart of an example method 500 for normalizingan insufficient raw signal based on characteristics of a prior detectedevent.

Method 500 includes ingesting a raw signal including a time stamp, anindication of a signal type, an indication of a signal source, andcontent from the signal source (501). For example, signal acquisitionmodule 287 can access raw signal 121E from source 171B. Raw signal 121Ecan include a time stamp, can indicate a signal type, can identifysource 171B, and can include content from source 171B. Signalacquisition module 287 can send raw signal 121E to signal formatter 180.Method 500 includes detecting evidence of an event from the content(502). For example, signal formatter 180 can detect evidence 491 of anevent from the characteristics, and including the content, of raw signal121E.

Method 500 includes determining that signal characteristics of the rawsignal are insufficient to normalize the signal along at least one of: atime dimension, a location dimension, or a context dimension into aTime, Location, Context (TLC) format (503). For example, signalformatter 180 can determine that the signal characteristics of rawsignal 121E are insufficient to normalize raw signal 121E along at leastone of: a time dimension, a location dimension, or a context dimensioninto a TLC format. In response to detecting evidence 491 andinsufficiency of the signal characteristics of raw signal 121E, signalformatter 180 can send evidence 491 to signal enrichment services 284.Signal enrichment services 284 can receive evidence 491 from signalformatter 180.

Method 500 includes requesting previously detected events at or near thelocation of the ingested raw signal from a geo cell database in responseto determining that the signal characteristics are insufficient (504).For example, in response to receiving evidence 491, signal enrichmentservices 284 can formulate query 492, including (at least a portion of)evidence 491. Signal enrichment services 284 can send query 492 to geocell database 111. Geo cell database 111 can receive query from signalenrichment services 284.

Method 500 includes receiving a previously detected event related to thedetected evidence from the geo cell database (505). Geo cell database111 can compare evidence 491 (of the portion thereof) to prior detectedevents in geo cell entries. Events related to evidence 491 can bereturned to signal enrichment services 284. For example, geo celldatabase 111 can determine that event 135 is related to evidence 491.Geo cell database 111 can return event 135 to signal enrichment services284.

Method 500 includes normalizing the raw signal into the Time, Location,Context (TLC) format including deriving at least one of: the timedimension, the location dimension, or the context dimension from acombination of the signal characteristics and characteristics of thepreviously detected event (506). For example, signal enrichment services284 and/or signal formatter 180 can normalize raw signal 121E intonormalized signal 122D, including time 123D, location 124D, context126D, content 127D, type 128D, and source 129D. Normalization caninclude deriving at least one of time 123D, location 124D, and context126D from a combination of characteristics of raw signal 121E andcharacteristics of event 135.

Other Architectures for Normalizing Insufficient Raw Signals

FIG. 6 illustrates an example of a more detailed computer architecture600 that facilitates normalizing an insufficient raw signal based onadditional information.

As depicted, computer architecture 600 includes social content ingestion674, web content ingestion 676, media content ingestion 677, signalacquisition services 687, signal enrichment services 684, formatter 689,geo database 611, local 612, NLP 613, knowledge graph 614, and othermodules 616. Social content ingestion 674, web content ingestion 676,media content ingestion 677, signal acquisition services 687, signalenrichment services 684, formatter 689, geo database 611, local 612, NLP613, knowledge graph 614, and other modules 616 can be connected to (orbe part of) a network, such as, for example, a system bus, a Local AreaNetwork (“LAN”), a Wide Area Network (“WAN”), and even the Internet.Accordingly, social content ingestion 674, web content ingestion 676,media content ingestion 677, signal acquisition services 687, signalenrichment services 684, formatter 689, geo database 611, local 612, NLP613, knowledge graph 614, and other modules 616 as well as any otherconnected computer systems and their components can create and exchangemessage related data (e.g., Internet Protocol (“IP”) datagrams and otherhigher layer protocols that utilize IP datagrams, such as, TransmissionControl Protocol (“TCP”), Hypertext Transfer Protocol (“HTTP”), SimpleMail Transfer Protocol (“SMTP”), Simple Object Access Protocol (SOAP),etc. or using other non-datagram protocols) over the network.

In general, social content ingestion 674 can ingest raw signals fromsocial networks 641 and prepare the raw signals for signal acquisitionservices 687. Similarly, web content ingestion 676 can ingest rawsignals from www 642, traffic reports 643, live weather 644, andemergency feeds 646 and prepare the raw signals for signal acquisitionservices 687. Likewise, media content ingestion 677 can ingest rawsignals from audio signals 647, social broadcasts 648, traffic cameras649, and public cameras 651 and prepare the raw signals for signalacquisition services 687.

Signal acquisition services 687 (e.g., similar to signal acquisitionmodule 287) can send raw signals to formatter 689. Formatter 689 (e.g.,similar to formatter 180) examines raw signals to determine raw signalsinclude evidence of a live event and to determine if characteristics ofa raw signal are sufficient to normalize the raw signal. If a raw signaldoes not provide evidence of a live event, formatter 689 may discard theraw event. If a raw signal does provide evidence of a live event andcharacteristics of the raw event are sufficient to normalize the rawevent, formatter 689 can normalize the raw event into a TLC format.Formatter 689 can send normalized signals to an event detectioninfrastructure, such as, for example, event detection infrastructure103.

If a raw signal does provide evidence of a live event andcharacteristics of the raw event are insufficient to normalize the rawevent, formatter 689 sends evidence of the live event to signalenrichment services 684. Signal enrichment services 684 (e.g., similarto signal enrichment services 284) can obtain supplemental informationto remediate raw signal insufficiencies. Supplemental information caninclude characteristics of one or more related signals and/orcharacteristics of one or more related events.

Signal enrichment services 684 can send signal request 652, includinglive event evidence, to signal acquisition services 687. In response,signal acquisition services 687 can acquire enriching signals 636. Oneor more of enriching signals 636 may already be known to signalacquisition services 687. Signal acquisition services 687 can also queryone or more of social content ingestion 674, web content ingestion 676,and media content ingestion 677 to acquire one or more other ofenriching signals 636.

Signal enrichment services 684 can also formulate query 651, includinglive event evidence. Signal enrichment services 684 can send query 651to one or more of geo 611, locale 612, NLP 613, knowledge graph 614, andother modules 616. The one or more of geo 611, locale 612, NLP 613,knowledge graph 614, and other modules 616 can return enriching data 634back to signal enrichment services 684. Signal enrichment services 684can send the enriching data on to formatter 689.

Formatter 689 can normalize a raw signal into a normalized signal 692using a combination of characteristics of the raw signal andcharacteristics of an enriching signal 626 and/or enriching data 634.

Accordingly, aspects of the invention facilitate acquisition of live,ongoing forms of data into an event detection system. Signals frommultiple sources of data can be combined and normalized for a commonpurpose (of event detection). Data ingestion, event detection, and eventnotification process data through multiple stages of logic withconcurrency.

A unified interface can handle incoming signals and content of any kind.The interface can handle live extraction of signals across dimensions oftime, location, and context. In some aspects, heuristic processes areused to determine one or more dimensions. Acquired signals can includetext and images as well as live-feed binaries, including live media inaudio, speech, fast still frames, video streams, etc.

Signal normalization enables the world's live signals to be collected atscale and analyzed for detection and validation of live events happeningglobally. A data ingestion and event detection pipeline aggregatessignals and combines detections of various strengths into truthfulevents. Thus, normalization increases event detection efficiencyfacilitating event detection closer to “live time” or at “moment zero”.

In one aspect, the entity analyzes data (signals) from different dataproviders (signal sources) to attempt to identify occurring live events(e.g., fire, police response, mass shooting, traffic accident, naturaldisaster, storm, active shooter, concerts, protests, etc.).

The present described aspects may be implemented in other specific formswithout departing from its spirit or essential characteristics. Thedescribed aspects are to be considered in all respects only asillustrative and not restrictive. The scope is, therefore, indicated bythe appended claims rather than by the foregoing description. Allchanges which come within the meaning and range of equivalency of theclaims are to be embraced within their scope.

What is claimed:
 1. A system comprising: a processor; and system memorycoupled to the processor and storing instructions configured to causethe processor to: ingest a first signal; determine a plurality of signalcharacteristics of the first signal; determine that the plurality ofsignal characteristics are insufficient to normalize the first signalalong at least one of a time dimension, a location dimension, or acontext dimension; based on determining that the signal characteristicsare insufficient, ingest a second signal; and apply atransdimensionality transform to data in the first signal to re-encodethe data from the first signal into normalized data having lowerdimensionality than the first signal, including deriving at least one ofthe time dimension, the location dimension, or the context dimensionfrom a combination of the plurality of signal characteristics of thefirst signal and at least one characteristic of the second signal. 2.The system of claim 1, wherein the first signal is ingested from a firstsignal source and the second signal is ingested from a second signalsource.
 3. The system of claim 2, wherein the first signal source is ofa first signal type and the second signal source is of a second signaltype.
 4. The system of claim 1, wherein the plurality of signalcharacteristics are insufficient to normalize the first signal along thelocation dimension.
 5. The system of claim 4, wherein the second signalis identified based on having a time dimension and/or a contextdimension that is relevant to the first signal.
 6. The system of claim1, wherein the plurality of signal characteristics are insufficient tonormalize the first signal along either or both of the time dimensionand/or the context dimension.
 7. The system of claim 6, wherein thesecond signal is identified based on having a location dimension that isrelevant to the first signal.
 8. The system of claim 1, wherein thequantity of dimensions of the first signal is greater than the quantityof dimensions of the normalized version of the first signal.
 9. Thesystem of claim 1, the first signal is a social signal and the secondsignal is a streaming signal.
 10. The system of claim 1, furthercomprising instructions configured to: detect an event based on at leastone of the time dimension, the location dimension, or the contextdimension of the normalized data; determine the event is relevant to anentity; and notify the entity about the event.
 11. A method executed ata computer system comprising one or more processors for supplementing afirst signal with a related second signal, the method comprising:ingesting a first signal; determining a plurality of signalcharacteristics of the first signal; determining that the plurality ofsignal characteristics are insufficient to normalize the first signalalong at least one of a time dimension, a location dimension, or acontext dimension; based on determining that the signal characteristicsare insufficient, ingesting a plurality of additional signals;identifying a second signal from the plurality of additional signalsthat is relevant to the signal; and applying a transdimensionalitytransform to data in the first signal to re-encode the data from thefirst signal into normalized data having lower dimensionality than thefirst signal, including deriving at least one of the time dimension, thelocation dimension, or the context dimension from a combination of theplurality of signal characteristics of the first signal andcharacteristics of the second signal.
 12. The method of claim 11,wherein the first signal is ingested from a first signal source and thesecond signal is ingested from a second signal source.
 13. The method ofclaim 12, wherein the first signal source is of a first signal type andthe second signal source is of a second signal type.
 14. The method ofclaim 11, wherein the plurality of signal characteristics areinsufficient to normalize the first signal along the location dimension.15. The method of claim 14, wherein the second signal is identifiedbased on having a time dimension and/or a context dimension that isrelevant to the first signal.
 16. The method of claim 11, wherein theplurality of signal characteristics are insufficient to normalize thefirst signal along either or both of the time dimension and/or thecontext dimension.
 17. The method of claim 16, wherein the second signalis identified based on having a location dimension that is relevant tothe first signal.
 18. The method of claim 11, wherein the quantity ofdimensions of the first signal is greater than the quantity ofdimensions of the normalized version of the first signal.
 19. The methodof claim 11, the first signal is a social signal and the second signalis a streaming signal.
 20. The method of claim 11, further comprisinginstructions configured to: detect an event based on at least one of thetime dimension, the location dimension, or the context dimension of thenormalized data; determine the event is relevant to an entity; andnotify the entity about the event.